The Bank Secrecy Act and Federal AML Framework: Reports and Penalties

The Bank Secrecy Act is the 1970 federal law that requires banks and many other businesses to identify their customers, keep records of financial activity, and report large cash transactions and suspicious behavior to the government so investigators can trace money laundering, tax evasion, and terrorist financing.¹ It reaches much further than the name suggests. Casinos, car dealers, jewelers, money transmitters, and ordinary small businesses that accept large cash payments all sit inside its rules, and individuals can trigger its criminal provisions without ever setting foot in a bank compliance office.

Who Has to Comply

The statute’s definition of “financial institution” under 31 U.S.C. § 5312 sweeps in commercial banks, trust companies, credit unions, thrift institutions, and U.S. branches of foreign banks, but it doesn’t stop there.² The same obligations apply to money services businesses (currency exchangers, check cashers, money transmitters), broker-dealers, insurance companies, loan and finance companies, dealers in precious metals, stones, or jewels, pawnbrokers, credit card system operators, and travel agencies.

Casinos and card clubs are pulled in once annual gross gaming revenue passes $1,000,000, and a casino that crosses that mark mid-year becomes subject to the rules from that point forward.³ Businesses in every one of these categories must build a written anti-money laundering program and file the same core reports a national bank would.

Ordinary trades and businesses outside that list still have their own separate obligation whenever they accept more than $10,000 in cash, covered later in this article.

The Reports the BSA Requires

Most of what the law does, from the customer’s point of view, is force the filing of a report when money crosses certain lines. Four reports carry the weight.

Currency Transaction Report (CTR)

A financial institution must file a CTR on FinCEN Form 112 any time a customer conducts a cash transaction, or multiple related cash transactions in a single business day, that exceeds $10,000.⁴ Deposits, withdrawals, and currency exchanges all count. The institution has no discretion. If the number is hit, the report gets filed.

Suspicious Activity Report (SAR)

A SAR is triggered not by a dollar figure alone but by conduct. When a transaction suggests a possible violation of federal law or lacks any apparent lawful purpose, the institution has to file. Most institutions use a $5,000 threshold; banks must file on any amount involving insider abuse and on transactions of $25,000 or more even when no suspect is identified. Money services businesses face a lower $2,000 threshold.⁵⁶

SARs are confidential. Federal law prohibits the institution and any current or former employee from telling the customer a report was filed or revealing anything that would disclose its existence.⁷ Tipping off a customer is a separate offense.

Foreign Bank Account Report (FBAR)

Any U.S. person, meaning individuals, corporations, partnerships, trusts, and estates, with a financial interest in or signature authority over foreign accounts whose combined value exceeds $10,000 at any point during the calendar year must file an FBAR.⁸ Penalties for missing it are severe. A non-willful violation can bring a civil penalty of up to $10,000 per account per year. Willful violations run to $100,000 or 50 percent of the highest account balance during the year, whichever is greater.⁹

Currency and Monetary Instrument Report (CMIR)

Moving more than $10,000 in cash or monetary instruments physically into or out of the country triggers a CMIR. If a family or group travels together, the threshold applies to the combined total, not per person.¹⁰

Form 8300: Large Cash Payments Outside the Banking System

Any trade or business that receives more than $10,000 in cash, either in a single transaction or in related transactions, must file IRS Form 8300 within 15 days.¹¹ A car dealer taking $15,000 in hundred-dollar bills, a jeweler selling an expensive watch for cash, and a contractor paid a large sum for construction work all fall under this rule.

“Cash” for Form 8300 purposes is broader than currency. Cashier’s checks, money orders, bank drafts, and traveler’s checks with a face value of $10,000 or less count as cash if received in a designated reporting transaction, meaning a retail sale of consumer durables, collectibles, or travel and entertainment where the total price exceeds $10,000. Those same instruments also count as cash whenever the business knows the customer is trying to avoid triggering the report. Personal checks drawn on the buyer’s own account do not count.¹²

When a customer makes multiple payments toward a single purchase, the business must file once cumulative cash received in any 12-month period crosses $10,000. A business can also voluntarily file on a suspicious transaction below the threshold.¹¹

Structuring Is a Federal Crime on Its Own

The single most costly mistake ordinary people make with the BSA is structuring. Breaking a transaction into pieces to keep each one below $10,000 and avoid the CTR filing is a federal crime regardless of where the money came from. Depositing $9,500 today and $9,500 tomorrow, done specifically to dodge the report, is an offense on its own even if the funds are entirely legitimate.¹³

The same statute makes it illegal to cause a financial institution to file a report with a material omission or misstatement, and helping someone else structure carries the same exposure. A basic structuring conviction can bring up to five years in federal prison and a fine. When structuring occurs alongside another federal crime or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum doubles to 10 years. Prosecutors treat structuring as strong circumstantial evidence of other criminal activity even when they cannot prove the underlying funds were illegal.

What Happens When You Open an Account

Section 326 of the USA PATRIOT Act requires every regulated financial institution to run a Customer Identification Program that verifies who is opening an account.¹⁴ Before an account is opened, the institution has to collect the customer’s name, date of birth (for individuals), a residential or business street address, and an identification number, typically a taxpayer ID for U.S. persons or a passport or alien ID number for non-U.S. persons. Verification uses a government photo ID, non-documentary checks against reliable databases, or both, and the institution also has to check the customer against government lists of known or suspected terrorists.¹⁵

Higher-risk accounts, including those tied to foreign political figures and their close associates, get enhanced treatment: the source of wealth, expected transaction patterns, and business rationale for the account all become part of the file.¹⁶

Beneficial Ownership When an Entity Opens the Account

Under FinCEN’s 2016 Customer Due Diligence Rule, when a legal entity opens an account the institution must identify any individual who owns 25 percent or more of it, plus at least one individual who controls or manages the entity.¹⁷ Form an LLC and walk into a bank, and expect to hand over personal identification for whoever owns and runs it.

The Corporate Transparency Act: Domestic Companies Are Now Exempt

The Corporate Transparency Act created a separate obligation for companies to report beneficial ownership information (BOI) directly to FinCEN, but the reach of that rule changed sharply in 2025. A FinCEN interim final rule published on March 26, 2025, exempted all entities created in the United States from BOI reporting.¹⁸ Only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction must file, and any beneficial owner who is a U.S. person is exempt from being reported even for those foreign companies. FinCEN has stated it will not enforce BOI penalties or fines against U.S. citizens or domestic companies. The CDD rule at account opening still applies; the two frameworks are separate.

AML Program Requirements for Covered Institutions

Every financial institution subject to the BSA has to build and maintain a written anti-money laundering program. The statute sets out four minimum components, and a fifth was added by regulation in 2016.⁷

Internal policies, procedures, and controls tailored to the institution’s risk profile, updated as money laundering techniques change.
A designated compliance officer with the authority and resources to run the program across the organization and serve as the point of contact for regulators.
Ongoing employee training so that staff at every level can recognize warning signs. A teller who does not know what structuring looks like cannot flag it.
Independent testing, internal or external, that evaluates whether the controls actually work.
Customer due diligence, added by the 2016 CDD Rule, requiring the institution to understand the nature and purpose of each customer relationship and to monitor for suspicious transactions on an ongoing basis.¹⁷

Recordkeeping

Filing the report is only part of the job. Institutions must retain BSA-related records for at least five years.¹⁹ That covers filed CTRs, SARs, and their supporting documentation, and customer identification records must be kept for five years after the account is closed, not five years from creation.

Beyond the report copies, the retention rules reach extensions of credit over $10,000 (when not secured by real estate), international transactions over $10,000, signature cards, account statements, deposits and checks over $100, certificates of deposit, funds transfers of $3,000 or more, and records of monetary instrument purchases of $3,000 or more.²⁰ Everything has to be stored so that regulators or investigators can reach it.

Penalties

The penalty structure runs on a sliding scale tied to intent.

Civil Penalties

A negligent BSA violation carries a civil penalty of up to $500 per violation, with an additional penalty of up to $50,000 when the negligence forms a pattern. Willful violations reach the greater of $25,000 or the amount involved in the transaction, capped at $100,000.⁹ These statutory figures are subject to inflation adjustments, though 2026 penalty levels remain at 2025 amounts because the required Consumer Price Index data was unavailable.

Criminal Penalties

Willful violations of BSA reporting or recordkeeping requirements carry up to $250,000 in fines and five years in federal prison. When a willful violation occurs alongside another federal crime, or as part of a pattern of illegal activity exceeding $100,000 in a 12-month period, the maximum climbs to $500,000 and 10 years.²¹ Courts can order forfeiture of any profit from the violation, and officers or employees of financial institutions who are convicted must repay bonuses received during the calendar year of the violation and the year after.

Who Enforces the Law

The Financial Crimes Enforcement Network, a bureau within the Treasury Department, is the primary administrator. FinCEN collects and analyzes the filings, issues regulations and guidance, and can impose civil monetary penalties on institutions that fall short.¹⁷

Examinations are split by institution type. The Office of the Comptroller of the Currency examines national banks and federal savings associations. The FDIC oversees state-chartered banks that are not members of the Federal Reserve System. The National Credit Union Administration handles credit unions. The SEC and FINRA examine broker-dealers. Each of these agencies runs its own teams that test whether an AML program works in practice, not only on paper.

1
FinCEN. BSA Timeline
2
Office of the Law Revision Counsel. 31 USC 5312 – Definitions and Application
3
eCFR. 31 CFR 1010.100 – General Definitions
4
Financial Crimes Enforcement Network (FinCEN). Notice to Customers – A CTR Reference Guide
5
FFIEC Bank Secrecy Act/Anti-Money Laundering InfoBase. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting
6
Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
7
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
8
Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)
9
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
10
U.S. Customs and Border Protection. Money and Other Monetary Instruments
11
Internal Revenue Service. Instructions for Form 8300 – Report of Cash Payments Over $10,000 Received in a Trade or Business
12
Internal Revenue Service. IRS Form 8300 Reference Guide
13
Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
14
Financial Crimes Enforcement Network. USA PATRIOT Act
15
eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks
16
FFIEC BSA/AML InfoBase. Customer Due Diligence
17
Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence (CDD) Final Rule
18
Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting
19
eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
20
FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements
21
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties